CVE-2017-6077
published 2017-02-22CVE-2017-6077: ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters…
PriorityP190critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2022-09-07
Exploited in the wild
EPSS
68.20%
99.3th percentile
ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| netgear | dgn2200_firmware | <= 10.0.0.50 | — |
| netgear | dgn2200_series_firmware | <= 10.0.0.50 | — |
Detection & IOCsextracted from sources · hover to see the quote
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Netgear DGN2200 RCE (CVE-2017-6077)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ping.cgi"; startswith; endswith; http.header; content:"DIAG_diag.htm|0d 0a|"; fast_pattern; http.request_body; content:"&ping_IPAddr="; content:"|3b|"; distance:0; reference:url,www.exploit-db.com/exploits/41394; reference:cve,2017-6077; classtype:attempted-user; sid:2027093; rev:4; metadata:attack_target IoT, created_at 2019_03_18, cve CVE_2017_6077, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2024_04_13;)
- →Exploit sends HTTP POST to /ping.cgi with shell metacharacter (semicolon, 0x3b) injected into the ping_IPAddr field to achieve OS command injection.
- →Exploit sets the HTTP Referer header to DIAG_diag.htm; presence of this referer in POST requests to /ping.cgi is a strong indicator of exploitation.
- →Exploit uses HTTP Basic Authentication with default credentials (admin/password, Gearguy/Geardog, or Guest/Guest) against the target router.
- →Presence of SUID backdoor binary /bin/bd on some firmware versions can be used for privilege escalation post-exploitation; check for its existence during forensic analysis.
- →CVE-2017-6077 can be chained with a CSRF (CVE-2017-6366) to achieve unauthenticated RCE by tricking an authenticated user into visiting a malicious page.
- ·The exploit targets firmware versions 10.0.0.20 through 10.0.0.50 (latest at time of disclosure); devices on these versions are vulnerable. ↗
- ·Hardcoded credentials (Gearguy/Geardog and Guest/Guest) are present on SOME firmware versions, lowering the bar for exploitation. ↗
- ·The vulnerability affects DGN2200 hardware versions v1, v2, v3, and v4; all variants should be treated as vulnerable until patched. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hjrc-qggq-2w49: ping
ghsa_unreviewed·2022-05-17
CVE-2017-6077 [CRITICAL] CWE-78 GHSA-hjrc-qggq-2w49: ping
ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request.
GHSA
GHSA-fmcr-2q62-c3m5: dnslookup
ghsa_unreviewed·2022-05-13·CVSS 9.8
CVE-2017-6334 [CRITICAL] CWE-78 GHSA-fmcr-2q62-c3m5: dnslookup
dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.
VulnCheck
NETGEAR DGN2200 Remote Code Execution Vulnerability
vulncheck·2017·CVSS 9.8
CVE-2017-6077 [CRITICAL] CWE-78 NETGEAR DGN2200 Remote Code Execution Vulnerability
NETGEAR DGN2200 Remote Code Execution Vulnerability
NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution.
Affected: NETGEAR Wireless Router DGN2200
Required Action: Apply updates per vendor instructions.
Exploitation References: https://web.archive.org/web/20200319160240/https://labs.bitdefender.com/2020/01/hold-my-beer-mirai-spinoff-named-liquorbot-incorporates-cryptomining/; https://cybersecurity.att.com/blogs/labs-research/att-alien-labs-finds-new-golang-malwarebotenago-targeting-millions-of-routers-and-iot-devices-with-more-than-30-exploits; https://cybersecurity.att.com/blogs/labs-research/botenago-strike-again-malware-source-code-uploaded-to-github; https://www.fortiguard.com/threat-signal-report/4389/botenago-malware-targets-multiple-iot
CISA
NETGEAR DGN2200 Remote Code Execution Vulnerability
cisa·2022-03-07·CVSS 9.8
CVE-2017-6077 [CRITICAL] CWE-78 NETGEAR DGN2200 Remote Code Execution Vulnerability
Vulnerability: NETGEAR DGN2200 Remote Code Execution Vulnerability
Affected: NETGEAR Wireless Router DGN2200
NETGEAR DGN2200 wireless routers contain a vulnerability that allows for remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2017-6077
Remediation Due Date: 2022-09-07
Suricata
ET EXPLOIT Possible Netgear DGN2200 RCE (CVE-2017-6077)
suricata·2019-03-18·CVSS 9.8
CVE-2017-6077 [CRITICAL] ET EXPLOIT Possible Netgear DGN2200 RCE (CVE-2017-6077)
ET EXPLOIT Possible Netgear DGN2200 RCE (CVE-2017-6077)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Possible Netgear DGN2200 RCE (CVE-2017-6077)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ping.cgi"; startswith; endswith; http.header; content:"DIAG_diag.htm|0d 0a|"; fast_pattern; http.request_body; content:"&ping_IPAddr="; content:"|3b|"; distance:0; reference:url,www.exploit-db.com/exploits/41394; reference:cve,2017-6077; classtype:attempted-user; sid:2027093; rev:4; metadata:attack_target IoT, created_at 2019_03_18, cve CVE_2017_6077, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag CISA_KEV, updated_at 2024_04_13;)
Exploit-DB
Netgear DGN2200v1/v2/v3/v4 - Cross-Site Request Forgery
exploitdb·2017-02-28·CVSS 9.8
CVE-2017-6334 [CRITICAL] Netgear DGN2200v1/v2/v3/v4 - Cross-Site Request Forgery
Netgear DGN2200v1/v2/v3/v4 - Cross-Site Request Forgery
---
# Exploit Title: NETGEAR Firmware DGN2200v1/v2/v3/v4 CSRF which leads to RCE through CVE-2017-6334
# Date: 2017-02-28
# Exploit Author: SivertPL
# Vendor Homepage: http://netgear.com/
# Software Link: http://www.downloads.netgear.com/files/GDC/DGN2200/DGN2200%20Firmware%20Version%201.0.0.20%20-%20Initial%20Release%20(NA).zip
# Version: 10.0.0.20 (initial) - 10.0.0.50 (latest, still 0-day!)
# Tested on: DGN2200v1,v2,v3,v4
# CVE: CVE-2017-6366
A quite dangerous CSRF was discovered on all DGN2200 firmwares.
When chained with either CVE-2017-6077 or CVE-2017-6334, allows for unauthenticated (sic!) RCE after tricking somebody logged in to the router to view a website.
netgear router CSRF
Would You Dare To?
Exploit-DB
Netgear DGN2200v1/v2/v3/v4 - 'ping.cgi' Remote Command Execution
exploitdb·2017-02-18
CVE-2017-6077 Netgear DGN2200v1/v2/v3/v4 - 'ping.cgi' Remote Command Execution
Netgear DGN2200v1/v2/v3/v4 - 'ping.cgi' Remote Command Execution
---
#!/usr/bin/python
#Provides access to default user account, privileges can be easily elevated by using either:
# - a kernel exploit (ex. memodipper was tested and it worked)
# - by executing /bin/bd (suid backdoor present on SOME but not all versions)
# - by manipulating the httpd config files to trick the root user into executing your code (separate advisory will be released soon along with the 2nd vuln)
#Pozdrawiam: Kornela, Komara i Sknerusa
import sys
import requests
#You can change these credentials to ex. Gearguy/Geardog or Guest/Guest which are hardcoded on SOME firmware versions
#These routers DO NOT support telnet/ssh access so you can use this exploit to access the shell if you want to
login = 'admin'
pass
No writeups or analysis indexed.
2017-02-22
Published
2022-03-07
Added to CISA KEV
Exploited in the wild